DOP-C02 · Question #39
A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL…
The correct answer is B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer. Manually check the. Option B is the correct answer. By associating the CodeCommit repository with Amazon CodeGuru Reviewer, the code can be checked for any hardcoded secrets during code reviews. When a hardcoded secret is detected, CodeGuru Reviewer will recommend updating the code to retrieve the…
Question
A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code. A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets. What is the MOST secure solution that meets these requirements?
Options
- AEnable Amazon CodeGuru Profiler. Decorate the handler function with @with_lambda_profiler().
- BAssociate the CodeCommit repository with Amazon CodeGuru Reviewer. Manually check the
- CEnable Amazon CodeGuru Profiler. Decorate the handler function with @with_lambda_profiler().
- DAssociate the CodeCommit repository with Amazon CodeGuru Reviewer. Manually check the
How the community answered
(50 responses)- A4% (2)
- B84% (42)
- C10% (5)
- D2% (1)
Explanation
Option B is the correct answer. By associating the CodeCommit repository with Amazon CodeGuru Reviewer, the code can be checked for any hardcoded secrets during code reviews. When a hardcoded secret is detected, CodeGuru Reviewer will recommend updating the code to retrieve the secret from a secure storage service like AWS Secrets Manager. The DevOps engineer can choose the option to protect the secret and then update the SAM templates and Python code to retrieve the secret from AWS Secrets Manager instead of hardcoding it in the
Topics
Community Discussion
No community discussion yet for this question.